> TODAY'S SUMMARY (124 articles)
Today's cybersecurity news highlights several critical threats and trends:
1. ConnectWise has suspended its Cloud Backup service following a supply chain attack that compromised Microsoft 365 accounts, exposing sensitive customer data.
2. Hackers exploited vulnerabilities in Plex servers to deploy cryptocurrency miners and proxy software, emphasizing the urgency for users to apply security updates.
3. A breach in the OpenCode AI platform may have exposed API keys for major AI providers, including OpenAI and Google, raising concerns over data security in AI applications.
4. Malware campaigns are increasingly targeting popular software like AOMEI and WordPress plugins, indicating a rise in supply chain attacks.
5. Ongoing spyware incidents in Serbia highlight the political use of surveillance technologies ahead of elections, while phishing attacks on Microsoft brands are on the rise.
6. Critical vulnerabilities in various systems, including Oracle and Drupal, have been reported, underlining the need for timely patching and security measures.
Organizations should remain vigilant, prioritize patching, and enhance their defenses against evolving threats.
|
// AI-powered summary generated at 20:01
Fake Booking reservation cancellations and fake BSODs trick victims into executing malicious code leading to RAT infections.
The post Sophisticated ClickFix Campaign Targeting Hospitality Sector appeared first on SecurityWeek.
UK government’s new Cyber Action plan looks to provide more ‘hands-on’ support for protecting against and responding to security incidents
In the race to deploy autonomous AI agents, organizations are inadvertently building on a foundation of shifting sand. While security teams have spent the last year focused on "Prompt Injection" and "Model Poisoning," a much older, more dangerous adversary has quietly become the primary attack vecto...
Order and contact details accessed via ecommerce partner, and phishing has begun Blockchain security biz Ledger says customer information was accessed in a breach at its ecommerce payment partner Global-e, and is warning that other brands using the platform may also be affected.…
Un groupe de pirates informatiques s'attaque à la Ville du Corsaire Jean-Bart, Dunkerque. Une prise d'otage qui réclame 3 millions de dollars de rançon....
The initial access broker (IAB) relies on credentials exfiltrated using information stealers to hack organizations.
The post Dozens of Major Data Breaches Linked to Single Threat Actor appeared first on SecurityWeek.
The FTC is seeking a $10 million settlement over allegations that children’s privacy laws were violated through the mislabeling of kid-focused YouTube videos.
Articles related to cyber risk quantification, cyber risk management, and cyber resilience.
The post Turning AI Risk Awareness Into Robust AI Governance | Kovrr appeared first on Security Boulevard.
Source: Securonix
Cybersecurity researchers have disclosed details of a new campaign dubbed PHALT#BLYX that has leveraged ClickFix-style lures to display fixes for fake blue screen of death (BSoD) errors in attacks targeting the European hospitality sector.
The end goal of the multi-stage campaign i...
For too long, fraud – an illicit economy rivaling the GDP of G20 nations – has been seen as a cost of doing business, a nuisance to be absorbed by banks and consumers. That perception is a dangerous relic. Modern fraud blends geopolitics with advanced technical tactics, carried out through criminal...
AI coding assistants are rapidly becoming part of everyday software development. From generating boilerplate code to suggesting entire dependency stacks, these tools promise faster delivery and higher productivity.
The post Guardrails Make AI-Assisted Development Safer By Design appeared first...
It normally begins as any other day. Your website is live. Your APIs are responding. Customers are checking out, logging in, and going about their lives. Then suddenly it all comes to an end. The homepage refuses to load. APIs start generating TLS errors. Mobile apps can’t connect. Support tickets a...
The Invisible Half of the Identity Universe
Identity used to live in one place - an LDAP directory, an HR system, a single IAM portal.
Not anymore. Today, identity is fragmented across SaaS, on-prem, IaaS, PaaS, home-grown, and shadow applications. Each of these environments carries its own accounts...
How an Ohio district uses Cloud Monitor to gain visibility, prevent risk, and stay prepared in Google Workspace Morgan Local Schools is located in rural McConnelsville, Ohio, serving about 1,600 students and 250 staff. With limited home internet access throughout the community, the district relies h...
As December 2025 comes to a close, Sonrai’s latest review of newly released AWS permissions highlights a continued expansion of cloud privilege. This month’s updates span identity, observability, AI, and managed service infrastructure, with changes across CloudWatch, CloudFront, Bedrock, EKS, SageMa...
Popular artificial intelligence (AI)-powered Microsoft Visual Studio Code (VS Code) forks such as Cursor, Windsurf, Google Antigravity, and Trae have been found to recommend extensions that are non-existent in the Open VSX registry, potentially opening the door to supply chain risks when bad actors...
The VPN company has conducted an investigation after a threat actor claimed to have hacked its systems.Â
The post NordVPN Denies Breach After Hacker Leaks Data appeared first on SecurityWeek.
Security researchers have flagged a high-severity flaw in Open WebUI, a self-hosted enterprise interface for large language models, that allows external model servers connected via its Direct Connections feature to inject malicious code and hijack AI workloads.
The issue, t...
Microsoft has pushed back against claims that multiple prompt injection and sandbox-related issues raised by a security engineer in its Copilot AI assistant constitute security vulnerabilities. The development highlights a growing divide between how vendors and researchers define risk in generative...
JLR’s wholesale sales plunged 43% and retail drops 25% in the third quarter of 2025 following the 2025 cyber-attack